81–90 of 316 posts
Earlier quoted context omitted.
Those cost more.
Much cheaper than trying to put out the fires caused by not using them. Experience costs more because it pays off.
Why can't people bother to construct a minimally secure encryption system given that there are so many good documents and code examples out there? I don't mean anything with ratcheting, forward secrecy, replay protection, nonce reuse resistance, or any other bells and whistles, just basic competent symmetric encryption without gaping holes or ridiculous bizarre design choices? It's not hard! (1) Generate 12 bytes of…
Or use TLS end to end like a normal company...
Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this. If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing. If you waste your time on user privacy y…
Agree, but I want to add something: the usability of Zoom is good, even for casual computer users. Strategically, they focussed on what they considered to be the things that would give them sales. Not saying it is good, but it certainly worked for them (at least until now).
She already had to use MS Teams, Slack, Jitsu and Zoom. Her take was that Zoom was by far the most usable tool. And most of her 20 years younger co-students agree.
Sadly most people don't even know about the problematic status of Zoom. And if one tells them, most do not understand what's so problematic about that.
Was this done in the interest of convenience, as most Zoom appologists have been clamining?
This looks like either incompetence or intentionally weak crypto.
Earlier quoted context omitted.
I didn't read it as suggesting it was "shady business". I read it as an insinuation that the company didn't know what it was doing from the top down, so they didn't hire smartly or manage well; they just threw numbers of people at the problem (and got predictably bad results). With good management, a team of 50 should be able to provide what Zoom provides.
Yeah, moments after replying I realized there is a more charitable read :-) Of course, with this read comes the age old question of "I can build Google/FB with 20 good men, what are they doing?"
Earlier quoted context omitted.
> Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. ...you're joking right? The Wikipedia example for why ECB is not recommended is literally an image: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operat…
No comment on the original claim, but that example is encryption applied to an uncompressed image. (Adjacent identical pixels are not typically represented individually when compressed, and thus encryption could not cause the banding patterns seen in those regions of the image if it were compressed prior to encryption.)
Compression does not introdoce entropy to a stream. So assuming that saying the stream is compressed and calling it good is a very bad idea. Please refer to Shannon's source coding theorem. If anything, compression reduces the entropy in the information.
Earlier quoted context omitted.
If the encryption scheme is poor, why would the data being compressed or not matter?
Compression already makes a compressed file roughly indistinguishable from random noise (module access to the decompressor). So the patterns have been removed. That doesn’t make this good , but it means that one specific example isn’t immediately applicable.
Earlier quoted context omitted.
> Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. ...you're joking right? The Wikipedia example for why ECB is not recommended is literally an image: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operat…
It's definitely a terrible choice for uncompressed images or video. I'm arguing it probably isn't that bad for highly compressed video. That being said, if you're encrypting any data stream you should use an appropriate stream cipher.
If anything, it reduces entropy.
Earlier quoted context omitted.
Agree, but I want to add something: the usability of Zoom is good, even for casual computer users. Strategically, they focussed on what they considered to be the things that would give them sales. Not saying it is good, but it certainly worked for them (at least until now).
I agree. My SO ist currently studying from home due to the pandemic. A lot of professors and tutors use what they find first. There is no standard. She already had to use MS Teams, Slack, Jitsu and Zoom. Her take was that Zoom was by far the most usable tool. And most of her 20 years younger co-students agree. Sadly most people don't even know about the problematic status of Zoom. And if one tells them, most do not u…
When the alternatives don't work, it doesn't really matter how secure the alternatives are.
Earlier quoted context omitted.
Much cheaper than trying to put out the fires caused by not using them. Experience costs more because it pays off.
Yes, but people are short sighted. They also probably think “I’d rather grow quickly and be able to afford this down the line than do it right and risk missing out.”
Which comes from being inexperienced as well. And an experienced hand can save you money immediately. Such as selecting a more appropriate programming language to implement the project in. Suggesting an appropriate library to use rather than rolling one's own. Avoiding multithreaded coding disasters. Having a backup system that works. Having a revision control system that works. Knowing that unit tests have an immediate payoff. Avoiding stupid metrics like paying people based on lines of code written. Avoiding rolling your own encryption. Don't transmit passwords in plaintext. Don't do illegal things. Don't leave yourself wide open to lawsuits. Use a real CPA to do your taxes. Keep proper business records so the IRS doesn't hang you. And on and on.
My CPA makes lots of money when some young entrepreneur comes in all terrified that the IRS is auditing him and he kept no records and didn't even file returns.
An experienced hand will tell you to never ignore and never mess with the tax man.
Check out what happened to Will Smith when he paid no attention to the IRS. All his proceeds from "Fresh Prince of Bel Air" went to the IRS as taxes, interest, and penalties.